
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
nextjs-lambda-webpack-plugin
Advanced tools
Webpack plugin that generates a AWS Lambda compatible package for NextJS
This plugin modifies a serverless NextJS build to add in a compatibility layer for AWS Lambda together with a handler that handles routing.
The standard handler reacts to Application Load Balancer events but it also has an alternative handler for API Gateway V2.
Warning: this is still early software and only supports SSR pages, static generation is still a work in progress
Add this plugin to your NextJS project as a dev dependency with either of the following commands:
# npm
npm install nextjs-lambda-webpack-plugin --save-dev
# yarn
yarn add -D nextjs-lambda-webpack-plugin
Next up add the plugin to your next.config.js:
const NextJSLambdaWebpackPlugin = require('nextjs-lambda-webpack-plugin')
const isServerless = (target) => target === ('serverless' || 'experimental-serverless-trace')
module.exports = {
webpack: (config, options) => {
if (config.mode === 'production' && isServerless(options.config.target)) {
config.plugins.push(new NextJSLambdaWebpackPlugin(options))
}
}
}
After the build two folders will be available in the default dist_lambda/ build folder.
lambda/ contains the code and should be uploaded to a lambda functionassets/ contains the assets that should be uploaded to a S3 bucketNote: To properly access static files, it's best to set an asset prefix to your s3 bucket
The build exports two lambda handlers
index.handler is the default and should be invocated by an Application Load Balancerindex.ApiGatewayHandler is an alternative that can be invocated by Api Gateway V2A lot of the code has been made available by the serverless-next.js project, major thanks for all their work.
FAQs
Webpack plugin that generates a AWS Lambda compatible package for NextJS
We found that nextjs-lambda-webpack-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.